[isar-cip-core,0/7] Add option to encrypt the rootfs

Message

Quirin Gylstorff April 19, 2024, 8:20 a.m. UTC

From: Quirin Gylstorff <[e-mail]>

This adds the option to encrypt both root file system partions(systema
and systemb). The encrypted partition can be updated with SWUpdate.

Currently an update will lead to a reencryption of the update partition as
the underlying device(/dev/sdaX) is written instead of the device mapper
partition.

Changes from https://lists.cip-project.org/g/cip-dev/message/15512:
 - add partition labels for a/b partitions
 - use a/b rootfs configuration instead seperate wks file


Quirin Gylstorff (7):
  wic/*: Add part-labels to system partition
  initramfs: allow empty mountpoint for crypt hooks
  fix: disk formatting
  initramfs-crypt: Only resize partition if ext* formatted
  use luks2 to identify encrypted partition
  Kconfig: Add option to encrypt the rootfs
  README: Add rootfs encryption

 Kconfig                                       | 20 ++++++++++++++--
 doc/README.tpm2.encryption.md                 | 12 +++++++++-
 kas/opt/encrypt-rootfs.yml                    | 22 +++++++++++++++++
 .../files/encrypt_partition.script            | 24 ++++++++++++++-----
 .../files/mount_crypt_partitions.script       |  4 +++-
 wic/bbb-efibootguard.wks.in                   |  4 ++--
 wic/hihope-rzg2m-efibootguard.wks.in          |  4 ++--
 wic/qemu-amd64-efibootguard-secureboot.wks.in |  4 ++--
 wic/qemu-arm64-efibootguard-secureboot.wks.in |  4 ++--
 wic/qemu-arm64-efibootguard.wks.in            |  4 ++--
 wic/qemu-riscv64-efibootguard.wks.in          |  4 ++--
 wic/x86-efibootguard.wks.in                   |  4 ++--
 12 files changed, 86 insertions(+), 24 deletions(-)
 create mode 100644 kas/opt/encrypt-rootfs.yml